Function validate_bash_command 

pub fn validate_bash_command(
    workspace_root: &Path,
    cwd: &Path,
    thread_id: &str,
    command: &str,
) -> Result<()>

Reject statically visible shell writes that bypass the managed session area.

Bash remains a general-purpose operator-controlled capability, so this is not presented as a filesystem sandbox. It covers the high-confidence cases an agent can correct immediately: literal output redirects, common destination arguments, and embedded language file-writer calls that name a Winx helper.